Who contributed to Kubernetes on May 20, 2026?

6 developers shipped this update, including a7i, hdp617, pohly, jberkus, kfess, and pacoxu.

What were the notable Kubernetes updates?

[descheduler v0.36.0] promote images, metis/daemon: restrict Unix domain socket permissions (#1131), and IPAM: Fix index out of range panic in extractDefaultNwCIDRs (#1133).

@kubernetes

Container orchestration - what platform teams ship on

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

DESCHEDULER V0.36.0 SHIPS; GCP PROVIDER TIGHTENS SOCKET SECURITY

By RepoJournal · Filed 06:01 UTC on May 20, 2026 · About Kubernetes

6 people shipped this

a7i @a7i 1 cited

hdp617 @hdp617 1 cited

pohly @pohly 1 cited

jberkus @jberkus 1 cited

kfess @kfess 1 cited

pacoxu @pacoxu 1 cited

Descheduler images promoted to v0.36.0 across all architectures as cloud-provider-gcp hardens Unix socket permissions to block privilege escalation.

The descheduler v0.36.0 release is now live with images promoted across amd64, arm64, and arm platforms [1], clearing the path for clusters running pod eviction workflows. In security news, cloud-provider-gcp restricted Metis IPAM daemon socket permissions to 0600 [2], eliminating a privilege escalation vector where overly permissive umask could allow unauthorized access to the CNI socket. The same repository also patched an index-out-of-range panic in IPAM's subnetwork parsing [3] and anchored NetworkAttachment validation regex to prevent malformed identifiers from corrupting cluster state [4]. Test infrastructure made two major moves: periodic E2E tests are migrating from legacy kubetest2 to kOps-based conformance infrastructure [5], and DRA canary jobs are experimenting with direct e2e_node.test invocation instead of kubetest2 wrappers [6]. Leadership changes at etcd come as Ivan and Siyuan join, James and Wenjia retire [7]. The website team reorganized probe documentation under a unified concepts/workloads/pods/probes path [8] and published a Kubernetes v1.36 Memory QoS post in Chinese [9].

Action items

→ Pull descheduler v0.36.0 images if running pod eviction; verify architecture match kubernetes/k8s.io [plan]
→ If running cloud-provider-gcp with Metis IPAM, upgrade immediately for socket permission hardening kubernetes/cloud-provider-gcp [immediate]
→ Watch DRA E2E node testing migration; kubetest2 deprecation imminent kubernetes/test-infra [monitor]

References

[1] [descheduler v0.36.0] promote images ↗ kubernetes/k8s.io
[2] metis/daemon: restrict Unix domain socket permissions (#1131) kubernetes/cloud-provider-gcp
[3] IPAM: Fix index out of range panic in extractDefaultNwCIDRs (#1133) kubernetes/cloud-provider-gcp
[4] gnp: anchor NetworkAttachment validation regular expression (#1135) kubernetes/cloud-provider-gcp
[5] feat(e2e): migrate periodic E2E tests to kOps ↗ kubernetes/cloud-provider-gcp
[6] DRA: experiment with E2E node testing without kubetest2 ↗ kubernetes/test-infra
[7] Bring etcd leadership up to date. ↗ kubernetes/k8s.io
[8] Move probe concept pages to new concepts/workloads/pods/probes.md ↗ kubernetes/website
[9] blog(zh-cn): add v1.36 Memory QoS post ↗ kubernetes/website

Quick answers

What shipped in Kubernetes on May 20, 2026?: Descheduler images promoted to v0.36.0 across all architectures as cloud-provider-gcp hardens Unix socket permissions to block privilege escalation. In total, 27 commits and 18 pull requests landed.
Who contributed to Kubernetes on May 20, 2026?: 6 developers shipped this update, including a7i, hdp617, pohly, jberkus, kfess, and pacoxu.
What were the notable Kubernetes updates?: [descheduler v0.36.0] promote images, metis/daemon: restrict Unix domain socket permissions (#1131), and IPAM: Fix index out of range panic in extractDefaultNwCIDRs (#1133).

SCHEDULER GAINS PREQUEUING FILTER, KUBELET USER NAMESPACES MOVE TO BETA

Kubernetes tackles the pod requeue bottleneck that's been choking large clusters, while user namespacing ships closer to production.

go 19 shipped 1-min read

@kubernetes 1 day ago

CLUSTER-AUTOSCALER PATCHES HIT ALL RELEASE BRANCHES AS DRA AND VOLUMEMOUNT BIND OPTIONS LAND

Cluster-autoscaler shipped four patch releases across versions 1.33 through 1.36 fixing ProvisioningRequest condition application and Scaleway node detection, while Kubernetes core merged DRA node operations and volumeMount bind mount options.

go 89 shipped 1-min read

@kubernetes 2 days ago

DRA GETS SMARTER RESOURCE ACCOUNTING, CLUSTER-AUTOSCALER ROLLS OUT FOUR PATCHES

Dynamic Resource Allocation fixed device accounting across its resource pool controller while cluster-autoscaler shipped maintenance releases across four versions.

go 52 shipped 1-min read

@kubernetes 3 days ago

DRA GRADUATES TO STABLE, KUBELET METRICS BYPASS CADVISOR, NAMESPACE LIFECYCLE UNBLOCKED

Three critical production fixes ship across core scheduler, metrics, and admission layers while DRA resource tracking stabilizes after surfacing a crash bug in the informer.

go 129 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.